NSX web interface becomes inaccessible and flaps after upgrading to version 9.1.0

Products

• VMware NSX

Issue/Introduction

• Prior to the upgrade, NSX Manager was configured with VMware Identity Manager (vIDM) as the authentication provider. 
  
  
• After upgrading NSX Manager to version 9.1.0 in a VCF environment, the NSX Manager web UI becomes inaccessible and reloads continuously.
  
  
• Exact error messages in /var/log/proxy/envoy_access_log.txt:
  
  "GET" "/login.jsp" "HTTP/2" 200 - 0 5087 7 4 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0" "12272e8d-3c1f-4183-ba56-21e7b2ff53e5" "" "127.0.0.1:6565"
"POST" "/vidm-oauth2-login" "HTTP/2" 302 UAEX 0 0 2 - "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0"

Environment

VMware Cloud Foundation 9.1.0

Cause

NSX Manager version 9.1.0 requires integration with vIDB 9.1.0 rather than VMware Identity Manager (vIDM). The NSX Manager attempts to route login requests through the legacy vIDM configuration, causing an authentication redirection loop.

Resolution

To resolve this issue, disable the legacy vIDM authentication configuration and reconfigure NSX Manager to use the new vIDB identity provider instance.

1. Log in to the NSX Manager web UI using local administrator credentials.
   
   https://<nsx-manager-ip-address>/login.jsp?local=true

2. Navigate to system identity settings and disable the existing vIDM integration.

3. Reconfigure NSX Manager to target the newly configured vIDB instance for Single Sign-On(SSO). Refer document Configuring VCF Single Sign-On

Additional Information

With vIDM enabled, user can still log in to NSX Manager with a local user account if user use the URL https://<nsx-manager-ip-address>/login.jsp?local=true. Refer document Configure VMware Identity Manager/Workspace ONE Access Integration